S9050: Vidar

S9050: Vidar describes [Vidar](https://attack.mitre.org/software/S9050) is a Windows infostealer that was first advertised in November 2018. Written in C++, [Vidar](https://attack.mitre.org/software/S9050) collects PII, cryptocurrency wallets, documents and other data within the compromised machine. Version 2 of [Vidar](https://attack.mitre.org/software/S9050) was published in October 2025, and has been used in numerous operations since its release. [Vidar](https://attack.mitre.org/software/S9050) has been observed alongside other malwar...

Executive priority

S9050: Vidar is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S9050: Vidar by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S9050: Vidar appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Vidar

Vidar is a Windows infostealer that was first advertised in November 2018. Written in C++, Vidar collects PII, cryptocurrency wallets, documents and other data within the compromised machine. Version 2 of Vidar was published in October 2025, and has been used in numerous operations since its release. Vidar has been observed alongside other malware strains, including STOP/Djvu ransomware, Mina.exe (an XMRIG miner), and Clip1.exe (a Laplas Clipper sample).[1][2][3][4][5][6][7][8]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques53 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1055.012	Process HollowingSub-technique	Vidar has used process hollowing to inject itself into an AppLaunch.exe process.[6]
Enterprise	T1480	Execution Guardrails	If a debugger or analysis environment is detected, Vidar has triggered a memory access violation exception, terminating its process by calling `RtlExitUserProcess`.[5]
Enterprise	T1548.002	Bypass User Account ControlSub-technique	Vidar has bypassed UAC by setting the Registry value `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA` to `0`, which disabled UAC.[6]
Enterprise	T1204.004	Malicious Copy and PasteSub-technique	Vidar has used fake CAPTCHAs to deliver and execute itself to victims.[3]
Enterprise	T1059.001	PowerShellSub-technique	Vidar has used PowerShell commands to modify Windows Defender’s list of excluded file extensions.[6]
Enterprise	T1569.002	Service ExecutionSub-technique	Vidar has resumed the suspended process RegAsm.exe.[5]
Enterprise	T1539	Steal Web Session Cookie	Vidar has extracted session cookies.[1][2]
Enterprise	T1566.002	Spearphishing LinkSub-technique	Vidar has been distributed through emails that include malicious links that redirect to fake download pages for Adobe Illustrator.[8]
Enterprise	T1622	Debugger Evasion	Vidar has used the `IsDebuggerPresent` function to detect whether a debugger is present on a victim machine.[5]
Enterprise	T1071.004	DNSSub-technique	Vidar has performed dynamic DNS resolution for gz[.]technicalprorj[.]xyz via 8.8.8[.]8.[2]
Enterprise	T1678	Delay Execution	Vidar has waited for six seconds using the command `timeout /t 6`.[6]
Enterprise	T1027.001	Binary PaddingSub-technique	An AES-encrypted version of Vidar has been embedded into an inflated executable named Setup.exe, bypassing defensive tools.[8]
Enterprise	T1489	Service Stop	Vidar has used the function `TerminateProcess` to terminate processes.[5] Vidar has forcefully terminated a process named Devil.exe using the command `C:\Windows\System32\cmd.exe” /c taskkill /im Devil.exe /f`.[6]
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	Vidar has obfuscated and/or AES-encrypted its core code to avoid debugger and/or analysis tools.[5][8] Vidar has used XOR to obfuscate the DLL name and the function name with key 0x05 to evade static string scanning.[4][8] Vidar has Base64-encoded information relating to cryptocurrency wallet extensions.[1]
Enterprise	T1119	Automated Collection	Vidar has collected data using automated scripts within malicious executables.[8]
Enterprise	T1041	Exfiltration Over C2 Channel	Vidar has exfiltrated sensitive data, such as credentials and cryptocurrency wallets, over the C2 server at 136.243.203[.]109.[4] Vidar has exfiltrated collected data through its C2 channel.[5]
Enterprise	T1614	System Location Discovery	Vidar has used the `EnumSystemLocalesW` function to enumerate installed or supported locales on the victim machine.[5] Vidar has also used a GET request to ip-api[.]com, resolving the victim's public IP address and country.[4]
Enterprise	T1124	System Time Discovery	Vidar has used the `GetSystemTimeAsFileTime` function to retrieve the current system date and time of the victim machine.[5]
Enterprise	T1071.001	Web ProtocolsSub-technique	Vidar has used HTTP/HTTPS to retrieve and send data and beacons.[2][3][6]
Enterprise	T1497.003	Time Based ChecksSub-technique	Vidar has used the `Sleep` API before C2 communication.[2]
Enterprise	T1070.004	File DeletionSub-technique	Vidar has self-deleted its initial executable to operate in memory.[3] Vidar has deleted collected data after exfiltration.[5] Vidar has also deleted the file Malware.exe and all .dll files in the ProgramData folder using the command `del /f /q “C:\Users\MalWorkstation\Desktop\Malware.exe” & del C:\ProgramData\*.dll`.[6]
Enterprise	T1112	Modify Registry	Vidar has set the Registry value associated with User Access Control (UAC) (i.e. `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA`) to `0`, which disabled UAC.[6]
Enterprise	T1140	Deobfuscate/Decode Files or Information	Vidar has used the function `CryptDecrypt`. Additionally, Vidar has decoded the .data section using bitwise XOR operations.[5] Vidar has decoded its core code after confirming debugger and/or analysis tools.[5]
Enterprise	T1055.003	Thread Execution HijackingSub-technique	Vidar has injected code into the suspended RegAsm.exe process.[5]
Enterprise	T1083	File and Directory Discovery	Vidar has gathered information about files on the victim machine.[4] Specifically, Vidar has used `FindFirstFileExW` and `FindNextFileW`.[5][6] Vidar has attempted to read hidden system directories, such as `$Recycle.Bin`, `$Windows.~BT`, and `$SysReset`, and the `C:\Windows\System32\config\SOFTWARE` directory using the `ReadFile` function. Vidar has also accessed internal streams, such as `$SDH`, and has read Jump Lists, which include recently opened files, programs and tasks.[5]
Enterprise	T1552.001	Credentials In FilesSub-technique	Vidar has collected credentials and cryptocurrency wallets stored internally.[1][2][4][5] Vidar has also decrypted local file stores, such as key4.db for Firefox, to find credentials.[1]
Enterprise	T1566.001	Spearphishing AttachmentSub-technique	Vidar has been distributed through emails that include malicious attachments, such as an ISO file, often masquerading as legitimate software, such as Adobe Photoshop or Microsoft Teams.[8]
Enterprise	T1074.001	Local Data StagingSub-technique	Vidar has compiled collected data into a randomly generated directory in the ProgramData folder.[5][6]
Enterprise	T1005	Data from Local System	Vidar has attempted to collect browser information.[8]
Enterprise	T1082	System Information Discovery	Vidar has gathered hardware IDs (HWIDs) regarding the victim machine.[4] Vidar has used `GetEnvironmentStringsW` and `GetModuleHandleExW` to gather information about the victim machine.[5] Vidar has collected OS data from the victim machine.[8][6]
Enterprise	T1204.001	Malicious LinkSub-technique	Vidar has been distributed via a malicious link that redirects to a filesharing website.[1]
Enterprise	T1555.003	Credentials from Web BrowsersSub-technique	Vidar has gathered credentials and data, including history, credit cards and auto-filled information, from decrypted browser files from Chrome, Firefox, Edge, Opera, Vivaldi, Waterfox and Palemoon.[1][2][4][5][8]
Enterprise	T1055	Process Injection	Vidar has injected itself into a legitimate Windows process.[8]
Enterprise	T1102.001	Dead Drop ResolverSub-technique	Vidar has used Telegram and Steam dead drop resolvers to recover its C2 domain.[1][2][3][5][6][8]
Enterprise	T1573.002	Asymmetric CryptographySub-technique	Vidar has used TLS 1.2 for C2 communication.[5]
Enterprise	T1497.001	System ChecksSub-technique	Vidar has used `ZwQueryInformationProcess` to query process debug-related attributes, such as ProcessDebugPort and ProcessDebugFlags, and to query ProcessInstrumentationCallback (0x25) to evade analysis environments and monitoring tools.[2][8]
Enterprise	T1222.001	Windows PermissionsSub-technique	Vidar has used `icacls` to modify file permissions.[8]
Enterprise	T1685	Disable or Modify Tools	Vidar has modified Windows Defender’s list of excluded file extensions, ensuring that .exe, .dll and .bat files are ignored during scans.[6] Vidar has loaded amsi.dll, which resolves the `AmsiScanBuffer` variable to return `E_INVALIDARG`, which may disable Windows Antimalware Scan Interface (AMSI).[4]
Enterprise	T1564.001	Hidden Files and DirectoriesSub-technique	Vidar has used a hidden directory in the ProgramData directory to store collected data.[6]
Enterprise	T1560.001	Archive via UtilitySub-technique	Vidar has packaged collected data into a zip file before exfiltration.[4][6][8]
Enterprise	T1027	Obfuscated Files or Information	Vidar has also used control flow flattening to slow down static analysis.[1]
Enterprise	T1106	Native API	Vidar has used native Windows functions, such as `LoadLibraryExW`, for discovery and execution.[5]
Enterprise	T1217	Browser Information Discovery	Vidar has collected browser history from the victim machine.[8][6]
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	Vidar has masqueraded as a Microsoft Edge DLL.[1] Vidar has masqueraded as MicrosoftUpdate.exe in the %TEMP% folder.[4][8] Vidar has masqueraded as a Notepad++ installer named npp.Installer.x64.zip.[6] Vidar has masqueraded as an executable named Setup.exe that mimics the legitimate Yahtzee application.[8]
Enterprise	T1036.001	Invalid Code SignatureSub-technique	Vidar has signed its DLL using fake certificates githab[.]com and grow[.]com.[1] Vidar has also signed its files with an expired digital certificate.[8]
Enterprise	T1129	Shared Modules	Vidar has loaded and executed common Windows DLLs during execution.[8]
Enterprise	T1027.005	Indicator Removal from ToolsSub-technique	Vidar has obfuscated stack strings within executable files.[8]
Enterprise	T1543	Create or Modify System Process	Vidar has created the RegAsm.exe process in a suspended state.[5]
Enterprise	T1189	Drive-by Compromise	Vidar has been distributed via malicious advertisements when users searched for “Notepad++.”[6]
Enterprise	T1016	System Network Configuration Discovery	Vidar has collected the victim's public IP address.[4]
Enterprise	T1105	Ingress Tool Transfer	Vidar has downloaded additional binaries from the C2 server such as sqlx[1].dll, a sqlite3 binary for data harvesting and exfiltration.[5] Vidar has also ownloaded get.zip, an archive containing several DLL libraries that extracted data from applications and browsers.[6]
Enterprise	T1574.001	DLLSub-technique	Vidar has been executed as a file named msedge_elf.dll through sideloading.[1]
Enterprise	T1057	Process Discovery	Vidar has used the functions `GetCurrentProcess` and `GetCurrentProcessId` to obtain information about processes.[5]

Associated objects

Groups, software, and campaigns

G1015: Scattered Spider

Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. [1] [2] The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [2] Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [3] [4] [5] Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. [6]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 1.0
Created: Sep 11, 2026, 19:05 UTC (UTC+00:00)
Modified: Sep 23, 2026, 18:54 UTC (UTC+00:00)
Raw hash: 3f1c9e92bf56a4b6...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	1.0	Sep 23, 2026, 18:54 UTC (UTC+00:00)	Current bundle	`3f1c9e92bf56…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Intrinsec_Vidar_April2026
Intrinsec. (2026, April). "Chaos is a ladder": Vidar's recent rise to the top. Retrieved April 27, 2026.
Open source URL
[2]
LevelBlue_Vidar_May2026
Joshi, M. (2026, May 7). Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication. Retrieved May 8, 2026.
Open source URL
[3]
CyberAus_Vidar_May2026
Australian Signals Directorate’s Australian Cyber Security Centre. (2026, May 7). ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure. Retrieved May 8, 2026.
Open source URL
[4]
Unit42_Vidar_July2026
Nannaka, B., Chhaparwal, P. (2026, July 7). Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation. Retrieved July 8, 2026.
Open source URL
[5]
Cyfirma_Vidar_June2024
CYFIRMA. (2024, June 3). Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware. Retrieved August 13, 2026.
Open source URL
[6]
Logpoint_StealerMalwareFamilies_2024
Khadgi, N. (n.d.). A Comprehensive Overview on Stealer Malware Families. Retrieved August 25, 2026.
Open source URL
[7]
CISA Scattered Spider Advisory November 2023
CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.
Open source URL
[8]
QuorumCyber_Vidar_March2023
Quorum Cyber. (n.d.). Malware Analysis Report Vidar - Stealerware. Retrieved August 28, 2026.
Open source URL
[9]
mitre-attackS9050
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use